Most AWS networking is learned by breaking something at 2am. This page lets you break it on purpose — flip a security group rule, delete a route, move a NAT gateway — and watch exactly where traffic stops and what error you'd see.
A three-tier VPC. Pick a request, press Send packet, and follow it hop by hop. Toggle any setting on the right and send it again — the diagram and the log both react.
Put nothing in a public subnet except load balancers and NAT gateways. Every scenario on this page that ends badly starts by breaking that rule.
The lab above runs a fixed topology. This one runs yours. Describe a VPC and everything inside it — subnets, route tables, gateways, security groups, instances — then send traffic through it and see which hop drops the packet. Every resource has an Enabled switch, so you can turn one thing off and watch what breaks. Designs are saved in your browser and export as a file.
| Name | Type | Parent | Values | On | Actions |
|---|
Drawn from the table. Boxes light up as the packet moves through them.
Pick a source and a destination from your own resources, then send a packet.
Static checks over the whole design — addressing, routing, exposure, redundancy. They re-run every time you change something.
Every design is a flat list of resources joined by name. Exported and imported files use JSON with exactly this shape; the YAML below is the same schema, annotated. Hand-write a file against it and the importer will take it.
Ten failures that account for most real AWS networking tickets. Each one loads a broken config into the lab above. Read the symptom, guess the cause, then reveal the fix.
On EKS, every pod takes a real IP from your subnet. That's fast — and it's how clusters run out of addresses. Size a node group here and watch the ceiling move.
No overlay, no encapsulation. Flow Logs see pod traffic, ALBs target pods directly, security groups can apply per pod.
Every external lookup fires 4 queries before succeeding. At scale this is a latency mystery that traces back to one line in resolv.conf.
Without group.name, 20 Ingresses build 20 load balancers at $16/mo each. With it, they share one.
The slash number is how many bits are locked. Bigger slash, smaller block. Type a range and see exactly what it covers — including the five addresses AWS keeps for itself.
Two VPCs that might ever connect must not overlap. Test a pair before you build.
The difference that causes the most confusion: security groups remember the conversation, NACLs don't. Send a request through both and see where the reply gets stuck.
Allow inbound 443 on both. Then send a request and watch the return trip.
Rules run lowest number first and the first match wins. Drag the deny rule's number below 100 to make it actually work.
| Security group | Network ACL | |
|---|---|---|
| Attaches to | A resource (ENI) | A whole subnet |
| Rule types | Allow only | Allow and Deny |
| State | Stateful — replies auto-allowed | Stateless — both directions needed |
| Evaluation | All rules together | Number order, first match wins |
| Can reference other groups | Yes — the killer feature | No, CIDR only |
| You need it | Always | Rarely — only for explicit denies |
NAT Gateway is the line item that surprises people. Charges stack: hourly, plus per-GB processing, plus standard egress. Model your traffic and see what an S3 endpoint saves.
us-east-1 list prices, mid-2026. Data transfer out to the internet is billed separately at ~$0.09/GB on top of NAT processing — so a byte leaving a private subnet is charged twice. Check the AWS Pricing Calculator before budgeting.
Tap any card for the full explanation, a worked example, and a link to the AWS documentation.